CVE-2021-22947

Name of the Vulnerable Software and Affected Versions curl versions 7.20.0 through 7.78.0

Description The issue concerns the implementation of the STARTTLS protocol in curl, which can lead to insufficient authentication of data. This allows a Man-In-The-Middle attacker to inject fake responses before the TLS handshake, and then pass through the legitimate server's TLS traffic, tricking curl into trusting the attacker's injected data as if it came from the TLS-protected server. Over POP3 and IMAP, an attacker can inject fake response data.

Recommendations For curl versions 7.20.0 through 7.78.0, update to version 7.79.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the STARTTLS protocol until a patch is available. Avoid using the vulnerable protocol to minimize the risk of exploitation.